chore(deps): bump github/codeql-action/analyze from 4.37.6 to 4.37.7

[dependabot]

Bumps github/codeql-action/analyze from 4.37.6 to 4.37.7.

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.7

• Update default CodeQL bundle version to 2.26.3. #4085

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
• The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

• Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
• Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

• Update default CodeQL bundle version to 2.26.0. #3995
• In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

... (truncated)

Commits

• ff2f1c6 Merge pull request #4093 from github/update-v4.37.7-be7a3dbb8
• 951a133 Update changelog for v4.37.7
• be7a3db Merge pull request #4087 from github/dependabot/npm_and_yarn/npm-minor-0aa561...
• 9310334 Merge pull request #4086 from github/mbg/thread-action-state-to-codeql
• b4d8a54 Rebuild
• ab5db25 Bump the npm-minor group across 1 directory with 8 updates
• 38055a3 Drop logger from databaseInitCluster in interface
• 1f87aed Merge pull request #4085 from github/update-bundle/codeql-bundle-v2.26.3
• dc1b98a Make logger available to getCodeQLForCmd
• 6f0220e Merge pull request #4084 from github/navntoft/bump-undici
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 16, 2026, 4:17 PM ET / 20:17 UTC.

ClawSweeper review

What this changes

Updates the pinned CodeQL analysis GitHub Action from v4.37.6 to v4.37.7 in the security workflow.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep this PR open: it leaves the two coordinated CodeQL action steps on different releases, and the updated analysis check is failing.

Priority: P2
Reviewed head: 3b001a385cba8674592431e5ef2203add1e29d11

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The update is focused, but it leaves the paired CodeQL actions unsynchronized and lacks a successful analysis run.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot workflow-only PR is exempt from contributor real-setup proof, but its CodeQL check still needs to pass.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot workflow-only PR is exempt from contributor real-setup proof, but its CodeQL check still needs to pass.
Evidence reviewed	5 items	Current workflow uses paired CodeQL release: Current main pins both the initialization and analysis steps to the same v4.37.6 revision, establishing the workflow’s paired-action configuration. PR changes only the analysis half: The proposed commit changes only the analysis action to v4.37.7, leaving initialization at v4.37.6. Workflow history deliberately upgrades both steps together: The most recent CodeQL upgrade is explicitly titled “bump codeql-action init and analyze to v4.37.6 together,” supporting same-release pins for these cooperating steps.
Findings	1 actionable finding	[P2] Keep both CodeQL action steps on v4.37.7
Security	None	None.

How this fits together

The CodeQL workflow initializes a Go analysis database and then analyzes it with GitHub’s CodeQL Action. Its result feeds repository security reporting and pull-request checks.

flowchart LR
A[Repository change] --> B[CodeQL workflow]
B --> C[Initialize CodeQL database]
C --> D[Run CodeQL analysis]
D --> E[Security analysis result]

Loading

Before merge

• Keep both CodeQL action steps on v4.37.7 (P2) - This changes only analyze while init remains on v4.37.6. The prior repository upgrade deliberately updated both together, and this leaves the analysis step consuming state from a different action release; update the init pin and version comment to the same v4.37.7 SHA before merge.
• Resolve merge risk (P1) - Merging with initialization on v4.37.6 and analysis on v4.37.7 leaves the security workflow outside its established paired-release configuration; the PR’s analyze check is already failing.

Findings

• [P2] Keep both CodeQL action steps on v4.37.7 — .github/workflows/codeql.yml:38

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
CodeQL action alignment	1 workflow file; 1 of 2 cooperating CodeQL action pins updated	Initialization remains on the prior release while the analysis step moves to v4.37.7.

Merge-risk options

Maintainer options:

1. Align the paired CodeQL pins (recommended)
   Update the initialization action to v4.37.7 as well, then require a successful CodeQL analysis run before merging.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Update the pinned CodeQL initialization action to ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd with its v4.37.7 comment, keep workflow permissions unchanged, and require the CodeQL analyze check to pass.

Technical review

Best possible solution:

Pin both CodeQL workflow steps to the same verified v4.37.7 revision and merge only after the CodeQL analysis run succeeds.

Do we have a high-confidence way to reproduce the issue?

Yes: source inspection shows the mismatched init/analyze revisions, and the supplied PR check context records a failed analyze run.

Is this the best way to solve the issue?

No: updating only the analysis entry point departs from the repository’s prior paired CodeQL upgrade; aligning both pins is the narrower supported repair.

Full review comments:

• [P2] Keep both CodeQL action steps on v4.37.7 — .github/workflows/codeql.yml:38
  This changes only analyze while init remains on v4.37.6. The prior repository upgrade deliberately updated both together, and this leaves the analysis step consuming state from a different action release; update the init pin and version comment to the same v4.37.7 SHA before merge.
  Confidence: 0.9

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against b793612bfa8a.

Labels

Label changes:

• add P2: The PR affects the repository security-analysis workflow and has a narrow, concrete repair before merge.
• add merge-risk: 🚨 automation: The action-version change directly affects CI security analysis, whose analyze run is currently failing.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot workflow-only PR is exempt from contributor real-setup proof, but its CodeQL check still needs to pass.

Label justifications:

• P2: The PR affects the repository security-analysis workflow and has a narrow, concrete repair before merge.
• merge-risk: 🚨 automation: The action-version change directly affects CI security analysis, whose analyze run is currently failing.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot workflow-only PR is exempt from contributor real-setup proof, but its CodeQL check still needs to pass.

Evidence

Acceptance criteria:

• [P1] actionlint .github/workflows/codeql.yml.
• [P1] Confirm the GitHub Actions CodeQL analyze check succeeds on the updated head.

What I checked:

• Current workflow uses paired CodeQL release: Current main pins both the initialization and analysis steps to the same v4.37.6 revision, establishing the workflow’s paired-action configuration. (.github/workflows/codeql.yml:33, b793612bfa8a)
• PR changes only the analysis half: The proposed commit changes only the analysis action to v4.37.7, leaving initialization at v4.37.6. (.github/workflows/codeql.yml:38, 3b001a385cba)
• Workflow history deliberately upgrades both steps together: The most recent CodeQL upgrade is explicitly titled “bump codeql-action init and analyze to v4.37.6 together,” supporting same-release pins for these cooperating steps. (.github/workflows/codeql.yml:33, 559430cb73a8)
• Current release has not implemented the update: The current main commit is release v0.8.5 and still contains the v4.37.6 analysis pin, so this PR is not redundant. (.github/workflows/codeql.yml:38, b793612bfa8a)
• Security workflow ownership: Repository ownership rules assign the workflows directory to the security operations team. (.github/CODEOWNERS:5, b793612bfa8a)

Likely related people:

• Peter Steinberger: Authored the repository’s most recent commit that upgraded both CodeQL action entry points together. (role: recent workflow contributor; confidence: high; commits: 559430cb73a8; files: .github/workflows/codeql.yml)
• Vincent Koc: Authored the commit that introduced commit-SHA pinning for GitHub Actions in this workflow. (role: workflow hardening contributor; confidence: medium; commits: 0390dcc930f1; files: .github/workflows/codeql.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Update the initialization pin to the same v4.37.7 SHA.
• Re-run the CodeQL analysis check and confirm it succeeds.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Superseded by #157, which lands this together with the rest of the dependency refresh in one coherent branch.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.